↳ GitHub sourceAnalytics ruleHigh

StealthTalk - Login outside work zone

Description

Identifies a single StealthTalk authentication originating from a country or city that does not match the user's assigned (expected) geographic zone. Each individual mismatch is treated as an incident - there is no aggregation threshold, since a single login from an unexpected country is high-confidence evidence of a credential issue. An incident fires when LoginCountry differs from AssignedCountry OR LoginCity differs from AssignedCity. Source IPv4, raw event ID, and both the observed and expected geo-locations are surfaced as entities and custom details for the SOC analyst.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 15m
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

StealthTalkAnomalousAuth

Data types

StealthTalkAnomalousAuth_CL

KQL query

Original query, unchanged.

let LookbackPeriod = 1h;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "GeoAnomalyLogin"
| where LoginCountry != AssignedCountry
     or LoginCity    != AssignedCity
| extend
    CountryMismatch = LoginCountry != AssignedCountry,
    CityMismatch    = LoginCity    != AssignedCity,
    AlertName       = "LoginOutsideWorkZone",
    AlertDetails    = strcat(
        "User ", UserId,
        " logged in from ", LoginCity, " (", LoginCountry, ")",
        " - assigned zone: ", AssignedCity, " (", AssignedCountry, ").",
        " Source IP: ", IpAddress, ".",
        " Country mismatch: ", tostring(LoginCountry != AssignedCountry), ".",
        " City mismatch: ", tostring(LoginCity != AssignedCity), "."
    )
| project
    TimeGenerated, UserId, DeviceId,
    LoginCountry, LoginCity, AssignedCountry, AssignedCity,
    CountryMismatch, CityMismatch, IpAddress,
    AppVersion, RawEventId, AlertName, AlertDetails

Declared entities

AccountHostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/StealthTalk/Analytic Rules/LoginOutsideWorkZone.yaml ↗
Commit: 629d1d3 ↗
Source identifier: a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c

Additional source files 2

Solutions/StealthTalk/Analytic Rules/LoginOutsideWorkZone.yamlsource ↗Solutions/StealthTalk/Data/Solution_StealthTalk.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.